{"version":3,"sources":["jsdelivr-header.js","/npm/openid@2.0.15/openid.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACsBA,MAAM,OAAE,QAAW,QAAQ,MAE3B,IAAI,OAAS,QAAQ,UAAU,OAC7B,OAAS,QAAQ,UACjB,KAAO,QAAQ,UACf,YAAc,QAAQ,eACtB,IAAM,QAAQ,OACd,KAAO,QAAQ,cAEb,cAAgB,CAAC,EACjB,aAAe,CAAC,EAChB,QAAU,CAAC,EAEX,oBAAsB,IAEtB,OAAS,QAET,KAAO,KAAK,IACZ,MAAQ,KAAK,KAEjB,SAAS,eAAe,EAAK,GAC3B,OAAO,OAAO,UAAU,eAAe,KAAK,EAAK,EACnD,CAEA,OAAO,aAAe,SAAU,EAAW,EAAO,EAAW,EAAQ,GACnE,KAAK,UAAY,EACjB,KAAK,MAAQ,GAAS,KACtB,KAAK,UAAY,EACjB,KAAK,OAAS,EACd,KAAK,WAAa,CACpB,EAEA,OAAO,aAAa,UAAU,aAAe,SAAU,EAAY,EAAW,GAC5E,OAAO,aAAa,EAAY,KAAK,UAAW,KAAK,MACnD,EAAW,KAAK,UAAW,EAAU,KAAK,WAAY,KAAK,OAC/D,EAEA,OAAO,aAAa,UAAU,gBAAkB,SAAU,EAAc,GACtE,OAAO,gBAAgB,EAAc,KAAK,UAAW,EAAU,KAAK,UAAW,KAAK,WAAY,KAAK,OACvG,EAIA,IAAI,OAAS,SAAU,GACrB,OAAI,EAAE,WAAW,GAAK,IACb,OAAO,aAAa,GAAK,EAE3B,CACT,EAEI,SAAW,SAAU,GACvB,OAAI,EAAE,KAAO,OAAO,aAAa,GACxB,EAAE,OAAO,GAGX,CACT,EAEI,OAAS,SAAU,GAErB,OADI,YACG,CACT,EAGI,QAAU,KACd,GAA6B,mBAAjB,OAAW,KAKrB,IACE,OAAO,KAAK,SAAU,UACtB,QAAU,OAAO,IACnB,CACA,MAAO,GACP,CAEc,OAAZ,UAIF,QAAU,SAAU,EAAK,GAAO,OAAO,IAAI,OAAO,EAAK,EAAM,GAG/D,IAAI,cAAgB,SAAU,GAC5B,OAAO,QAAQ,EAAK,UAAU,SAAS,SACzC,EAEI,cAAgB,SAAU,GAC5B,OAAO,QAAQ,EAAK,UAAU,SAAS,SACzC,EAEI,gBAAkB,SAAU,GAC9B,OAAO,cAAc,OAAO,GAC9B,EAEI,kBAAoB,SAAU,GAChC,OAAO,SAAS,cAAc,GAChC,EAEI,KAAO,SAAU,EAAG,GACtB,GAAI,EAAE,QAAU,EAAE,OAChB,MAAM,IAAI,MAAM,6BAIlB,IADA,IAAI,EAAI,GACC,EAAI,EAAG,EAAI,EAAE,SAAU,EAC9B,GAAK,OAAO,aAAa,EAAE,WAAW,GAAK,EAAE,WAAW,IAG1D,OAAO,CACT,EAEA,OAAO,gBAAkB,SAAU,EAAU,EAAM,EAAQ,EAAQ,EAAwB,GACzF,YAAW,WACT,OAAO,kBAAkB,EAC3B,GAA4B,IAAzB,GACH,cAAc,GAAU,CAAE,SAAU,EAAU,KAAM,EAAM,OAAQ,GAClE,EAAS,KACX,EAEA,OAAO,gBAAkB,SAAU,EAAQ,GACrC,OAAO,cAAc,IACvB,EAAS,KAAM,cAAc,IAG7B,EAAS,KAAM,KAEnB,EAEA,OAAO,kBAAoB,SAAU,GAEnC,cADO,cAAc,IACd,CACT,EAEA,OAAO,0BAA4B,SAAU,EAAK,EAAU,GAE1D,OADA,aAAa,GAAO,EACb,EAAS,KAClB,EAEA,OAAO,0BAA4B,SAAU,EAAK,GAChD,OAAK,OAAO,aAAa,IAIlB,EAAS,KAAM,aAAa,IAH1B,EAAS,KAAM,KAI1B,EAEA,IAAI,UAAY,SAAU,EAAQ,GAGhC,UAFA,EAAS,IAAI,MAAM,GAAQ,IACL,OAClB,EACF,GAAK,EAAO,MAIV,IAAK,IAAI,KAAO,EACV,eAAe,EAAQ,KACzB,EAAO,MAAM,GAAO,EAAO,SAL/B,EAAO,MAAQ,EAWnB,OAAO,IAAI,OAAO,EACpB,EACI,gBAAkB,SAAU,GAG9B,IAFA,IAAI,EAAQ,EAAK,MAAM,MACnB,EAAS,CAAC,EACL,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,IAAI,EAAO,EAAM,GAKjB,GAJI,EAAK,OAAS,GAA8B,MAAzB,EAAK,EAAK,OAAS,KACxC,EAAO,EAAK,UAAU,EAAG,EAAK,OAAS,KAG1B,IADH,EAAK,QAAQ,KACzB,CAGA,IAAI,EAAM,EAAK,OAAO,EAAG,EAAK,QAAQ,MAClC,EAAQ,EAAK,OAAO,EAAK,QAAQ,KAAO,GAC5C,EAAO,GAAO,CAHd,CAIF,CAEA,OAAO,CACT,EACI,qBAAuB,SAAU,GAEnC,OADA,EAAa,EAAW,QAAQ,aAAc,MAGT,IAAjC,EAAW,QAAQ,YACrB,EAAa,EAAW,UAAU,IAGhC,cAAc,KAAK,IAIY,IAA/B,EAAW,QAAQ,QAHd,EAMF,UAAY,GAZV,IAaX,EAEI,WAAa,SAAU,EAAS,GAClC,IAAI,EAAW,KAAK,MAAM,GAC1B,GAAgB,MAAZ,EACF,OAAO,KAIT,IADA,IAAI,EAAY,GACP,EAAI,EAAG,EAAM,EAAS,OAAQ,EAAI,IAAO,EAAG,CACnD,IAAI,EAAU,EAAS,GACnB,EAAW,CAAC,EAMhB,GAJA,EAAS,SAAW,EAAQ,IACxB,kBAAkB,KAAK,KACzB,EAAS,kBAAoB,EAAQ,IAEnB,2CAAhB,EAAQ,KACV,EAAS,QAAU,mCACnB,EAAS,gBAAkB,EAAQ,QAEhC,GAAoB,2CAAhB,EAAQ,KACf,EAAS,QAAU,uCAEhB,IAAoB,gCAAhB,EAAQ,MACC,gCAAhB,EAAQ,KAKR,SAJA,EAAS,QAAU,EAAQ,KAC3B,EAAS,gBAAkB,EAAQ,QAIrC,CACA,EAAU,KAAK,EACjB,CAEA,OAAO,CACT,EAEI,cAAgB,SAAU,GAC5B,IAAI,EAAiB,qDAAqD,KAAK,GAC/E,IAAK,GAAkB,EAAe,OAAS,EAC7C,OAAO,KAGT,IAAI,EAAiB,oBAAoB,KAAK,EAAe,IAC7D,OAAK,GAAkB,EAAe,OAAS,EACtC,KAGF,EAAe,EACxB,EAEI,cAAgB,SAAU,EAAM,GAClC,IAAI,EAAsB,IAAI,OAAO,gCAAkC,EAAM,oBAAqB,MAAM,KAAK,GAE7G,IAAK,GAAuB,EAAoB,OAAS,EACvD,OAAO,KAGT,IAAI,EAAO,uBAAuB,KAAK,EAAoB,IAE3D,OAAK,GAAQ,EAAK,OAAS,EAClB,KAEF,EAAK,EACd,EAEI,WAAa,SAAU,EAAS,EAAM,EAAU,GAClD,IAAI,EAAU,cAAc,GAC5B,GAAe,MAAX,EACF,OAAO,YAAY,EAAS,EAAU,EAAO,GAG/C,IAAI,EAAW,cAAc,EAAM,oBACnB,MAAZ,EAEc,OADhB,EAAW,cAAc,EAAM,kBAE7B,EAAS,MAIT,EAAS,CAAC,CACR,QAAS,+BACT,SAAU,EACV,kBAAmB,EACnB,gBALY,cAAc,EAAM,sBAWpC,EAAS,CAAC,CACR,QAAS,0CACT,SAAU,EACV,kBAAmB,EACnB,gBALY,cAAc,EAAM,sBAQtC,EAEI,eAAiB,SAAU,EAAU,GACvC,IAAI,EAAQ,wBAAwB,KAAK,GACzC,GAAa,MAAT,GAAiB,EAAM,OAAS,EAAG,CACrC,IAAI,EAAS,EAAM,GACnB,YAAY,EAAQ,EACtB,MAEE,EAAS,KAEb,EAEI,YAAc,SAAU,EAAQ,EAAU,GAC5C,GAAK,GAGA,GAAI,GAAQ,EACf,OAAO,EAAS,WAHhB,EAAO,EAMT,KAAK,EAAQ,MAAM,SAAU,EAAM,EAAS,GAC1C,GAAkB,KAAd,EACF,OAAO,EAAS,MAGlB,IAAI,EAAe,EAAQ,mBAC3B,GAAI,OAAO,GACT,KAAK,EAAc,MAAM,SAAU,EAAM,EAAS,GAE9C,EADgB,KAAd,GAA6B,MAAR,EACd,KAGA,WAAW,EAAc,GAEtC,SAEG,GAAY,MAAR,EAAc,CACrB,IAAI,EAAc,EAAQ,gBAG1B,OAAI,GAAgE,IAAhD,EAAY,QAAQ,yBAAqE,IAApC,EAAY,QAAQ,YAIpF,aAAa,EAAQ,EAAU,EAAO,EAAG,GAHzC,EAAS,WAAW,EAAQ,GAKvC,CACF,GACF,EAEI,aAAe,SAAU,EAAY,EAAU,EAAM,GACvD,GAAK,GAGA,GAAI,GAAQ,EACf,OAAO,EAAS,WAHhB,EAAO,EAMG,MAAR,EACF,KAAK,EAAY,MAAM,SAAU,EAAM,EAAS,GAC5B,KAAd,GAA6B,MAAR,EACvB,EAAS,MAGT,WAAW,EAAY,EAAM,EAAU,EAAO,EAElD,IAGA,WAAW,EAAY,EAAM,EAAU,EAG3C,EAEI,iBAAmB,SAAU,EAAY,EAAQ,EAAU,GAC7D,IACI,EADA,EAAO,IAAI,MAAM,IAGnB,EADE,IAAoB,EACR,+DAAiE,EAAK,KAGtE,EAAK,SAAW,KAAO,EAAK,KAAO,0BAMjD,KAAK,EAAa,MAAM,SAAU,EAAM,EAAS,GAC7B,KAAd,GAA6B,MAAR,EAClB,GAAoB,EAIvB,EAAS,MAHT,iBAAiB,EAAY,EAAQ,GAAU,GAUjD,eAAe,GAAM,SAAU,GACX,MAAb,GAAyC,GAApB,EAAU,QAAiB,GAAoB,EAIvE,EAAS,GAHT,iBAAiB,EAAY,EAAQ,GAAU,EAKnD,GAEJ,IAzBA,EAAS,KA2Bb,EAEA,OAAO,SAAW,SAAU,EAAY,EAAQ,GAE9C,KADA,EAAa,qBAAqB,IAEhC,OAAO,EAAS,CAAE,QAAS,sBAAwB,MAElB,IAA/B,EAAW,QAAQ,UAErB,EAAa,mBAAqB,EAAa,kCAIjD,YAAY,GAAY,SAAU,GAChC,GAAiB,MAAb,GAAyC,GAApB,EAAU,OAEjC,aAAa,GAAY,SAAU,GAChB,MAAb,GAAyC,GAApB,EAAU,OACjC,iBAAiB,EAAY,GAAQ,SAAU,GAC7C,EAAS,KAAM,EACjB,IAGA,EAAS,KAAM,EAEnB,QAEG,CAIH,IAAK,IAAI,EAAI,EAAG,EAAM,EAAU,OAAQ,EAAI,IAAO,EAAG,CACpD,IAAI,EAAW,EAAU,GACpB,EAAS,oBACX,EAAS,kBAAwD,IAArC,EAAS,QAAQ,QAAQ,SACtD,EAAS,kBAAoB,EAEjC,CACA,EAAS,KAAM,EACjB,CACF,GACF,EAEA,IAAI,gCAAkC,SAAU,GAC9C,IAEI,EAAK,OAAO,oBAFG,+KAE+B,UAIlD,OAFA,EAAG,eAEI,CACT,EAEA,OAAO,UAAY,SAAU,EAAU,EAAU,EAAQ,GACvD,IAAI,EAAwB,sCAAsC,EAAS,QAAS,GACpF,EAAY,EAAsB,UAClC,IAAI,EAAS,EAAsB,OAE/B,EAAK,MACmC,IAAxC,EAAU,QAAQ,mBACpB,EAAK,gCAAgC,GACrC,EAAO,qBAAuB,gBAAgB,EAAG,SAAS,WAC1D,EAAO,iBAAmB,gBAAgB,EAAG,aAAa,WAC1D,EAAO,6BAA+B,gBAAgB,EAAG,aAAa,YAGxE,MAAM,EAAS,SAAU,GAAQ,SAAU,EAAM,EAAS,GACxD,GAAmB,KAAd,GAAmC,KAAd,GAA+B,OAAT,EAC9C,OAAO,EAAS,CACd,QAAS,uBACR,CACD,MAAO,sBACP,WAAY,GAAK,EACjB,GAAI,qCAMR,GAAuB,qBAFvB,EAAO,gBAAgB,IAEd,aAA0E,IAArC,EAAS,QAAQ,QAAQ,SAAkB,OAAO,EAAK,IAAM,CACzG,GAAiB,WAAb,EACF,OAAI,GAAgE,IAAtD,EAAS,SAAS,cAAc,QAAQ,UAC7C,EAAS,CAAE,QAAS,yEAA2E,MAG/F,OAAO,UAAU,EAAU,EAAU,EAAQ,qBAGnD,GAAiB,qBAAb,EACP,OAAI,GAAgE,IAAtD,EAAS,SAAS,cAAc,QAAQ,UAC7C,EAAS,wEAAyE,MAelF,OAAO,UAAU,EAAU,EAAU,EAAQ,iBAGnD,GAAiB,aAAb,EACP,OAAO,OAAO,UAAU,EAAU,EAAU,EAAQ,UAExD,CAEA,GAAI,EAAK,MACP,EAAS,CAAE,QAAS,EAAK,OAAS,OAE/B,CACH,IAAI,EAAS,KAET,GAA8C,IAA9B,EAAU,QAAQ,OAAgB,SAAW,OAEjE,IAA4C,IAAxC,EAAU,QAAQ,iBACpB,EAAS,EAAK,YAEX,CACH,IAAI,EAAe,kBAAkB,EAAK,kBACtC,EAAe,OAAO,EAAG,cAAc,EAAc,SAAU,WAC/D,EAAO,OAAO,WAAW,GAC7B,EAAK,OAAO,QAAQ,EAAc,WAClC,EAAe,EAAK,OAAO,UAC3B,IAAI,EAAY,cAAc,EAAK,aACnC,EAAS,cAAc,KAAK,EAAW,GACzC,CAEA,IAAK,OAAO,EAAK,cACf,OAAO,EAAS,CAAE,QAAS,wFAA0F,MAGvH,OAAO,gBAAgB,EAAU,EAC/B,EAAK,aAAc,EAA0B,EAAlB,EAAK,YAAgB,SAAU,GACxD,GAAI,EACF,OAAO,EAAS,GAElB,EAAS,KAAM,EACjB,GACJ,CACF,GACF,EAEA,IAAI,sCAAwC,SAAU,EAAS,GAC7D,IAAI,EAAS,CACX,cAAe,aAkCjB,OA/BgC,IAA5B,EAAQ,QAAQ,SAClB,EAAO,aAAe,qCAGQ,IAA5B,EAAQ,QAAQ,QAA8B,WAAb,GACnC,EAAY,UACZ,EAAO,qBAAuB,YAC9B,EAAO,uBAAyB,WAEZ,qBAAb,GACyB,IAA5B,EAAQ,QAAQ,QAClB,EAAO,uBAAyB,GAChC,EAAO,qBAAuB,cAG9B,EAAO,uBAAyB,gBAChC,EAAO,qBAAuB,eAGZ,iBAAb,IACyB,IAA5B,EAAQ,QAAQ,SAClB,EAAO,uBAAyB,iBAElC,EAAO,qBAAuB,cAG9B,EAAY,YACZ,EAAO,qBAAuB,cAC9B,EAAO,uBAAyB,aAG3B,CAAE,UAAW,EAAW,OAAQ,EACzC,EAEA,OAAO,aAAe,SAAU,EAAY,EAAW,EAAO,EAAW,EAAW,EAAU,EAAY,GACxG,OAAO,SAAS,EAAY,GAAQ,SAAU,EAAO,GACnD,GAAI,EACF,OAAO,EAAS,GAElB,IAAK,GAAkC,IAArB,EAAU,OAC1B,OAAO,EAAS,CAAE,QAAS,+CAAiD,MAG9E,IAAI,GAAiB,GAErB,SAAU,EAAe,EAAO,GAC9B,IAAK,GAAS,EAAS,CACrB,IAAI,EAAW,EAAU,GAEzB,GAAI,EAAS,kBAAmB,CAC9B,IAAI,GAA+D,IAArC,EAAS,QAAQ,QAAQ,QAAiB,EAAS,iBAAmB,EAAS,mBAAqB,EAAS,gBAE3I,OAAO,OAAO,0BAA0B,EAA0B,EAAS,gBAAkB,EAAS,kBACpG,GAAU,SAAU,GAClB,OAAI,EACK,EAAS,GAEX,EAAS,KAAM,EACxB,GACJ,CACK,IAAyC,IAArC,EAAS,QAAQ,QAAQ,OAChC,OAAO,EAAS,KAAM,GAGtB,EAAe,CAAE,QAAS,uEAE9B,CACA,KAAM,GAAiB,EAAU,OAC/B,OAAO,EAAS,CAAE,QAAS,sDAAwD,MAGrF,IAAI,EAAkB,EAAU,GAC5B,EACF,uBAAuB,EAAiB,KAAM,EAC5C,EAAO,EAAW,GAAc,CAAC,EAAG,GAItC,OAAO,UAAU,GAAiB,SAAU,EAAO,GAC7C,IAAU,GAAU,EAAO,MAC7B,EAAe,GAAS,EAAO,MAAO,MAGtC,uBAAuB,EAAiB,EAAO,aAAc,EAC3D,EAAO,EAAW,GAAc,CAAC,EAAG,EAE1C,GAGH,CA5CD,EA6CF,GACF,EAEA,IAAI,uBAAyB,SAAU,EAAU,EAAc,EAAW,EAAO,EAAW,EAAY,GACtG,IAAI,EAAS,CACX,cAAe,EAAY,oBAAsB,iBAOnD,IAAK,IAAI,KAJgC,IAArC,EAAS,QAAQ,QAAQ,SAC3B,EAAO,aAAe,oCAGV,EACZ,GAAK,eAAe,EAAY,GAAhC,CAIA,IAAI,EAAY,EAAW,GAC3B,IAAK,IAAI,KAAO,EAAU,cACnB,eAAe,EAAU,cAAe,KAC7C,EAAO,GAAO,EAAU,cAAc,GALxC,CASF,GAAI,EAAS,kBACX,EAAO,qBAAuB,EAAS,kBACnC,EAAS,gBACX,EAAO,mBAAqB,EAAS,gBAGrC,EAAO,mBAAqB,EAAS,sBAGpC,KAAyC,IAArC,EAAS,QAAQ,QAAQ,OAKhC,OAAO,EAAS,CAAE,QAAS,wEAJ3B,EAAO,qBAAuB,EAAO,mBACnC,oDAIJ,CAYA,GAVI,IACF,EAAO,uBAAyB,GAG9B,IAGF,EAAO,oBAAsB,GAG3B,GACuC,IAArC,EAAS,QAAQ,QAAQ,OAC3B,EAAO,gBAAkB,EAGzB,EAAO,qBAAuB,OAG7B,IAAK,EACR,OAAO,EAAS,CAAE,QAAS,qCAG7B,EAAS,KAAM,UAAU,EAAS,SAAU,GAC9C,EAEA,OAAO,gBAAkB,SAAU,EAAc,EAAmB,EAAU,EAAW,EAAY,GACnG,EAAa,GAAc,CAAC,EAC5B,IAAI,EAAe,EACnB,GAA8B,iBAAnB,EAAgC,CACzC,GAAyC,QAArC,EAAa,OAAO,cAAyB,CAC/C,GAAgH,KAA3G,EAAa,QAAQ,iBAAmB,IAAI,cAAc,QAAQ,qCAcrE,OAAO,EAAS,CAAE,QAAS,+CAZ3B,IAAI,EAAO,GAeb,OAbE,EAAa,GAAG,QAAQ,SAAU,GAChC,GAAQ,CACV,SAEA,EAAa,GAAG,OAAO,WACrB,IAAI,EAAS,YAAY,MAAM,GAC/B,OAAO,qBAAqB,EAAQ,EAAU,EAAW,EAAY,EACvE,GAOJ,CACK,GAAyC,OAArC,EAAa,OAAO,cAC3B,OAAO,EAAS,CAAE,QAAS,gDAE7B,EAAe,EAAa,GAC9B,CAGA,IAAI,GADJ,EAAe,IAAI,MAAM,GAAc,IACb,MAE1B,OAAK,iBAAiB,EAAc,GAG7B,qBAAqB,EAAQ,EAAU,EAAW,EAAY,GAF5D,EAAS,CAAE,QAAS,sBAG/B,EAEA,IAAI,iBAAmB,SAAU,EAAc,GAC7C,IAAI,EAAoB,EAAa,MAAM,oBAC3C,IAAK,OAAO,GACV,OAAO,EAIT,KADA,EAAoB,IAAI,MAAM,GAAmB,IAE/C,OAAO,EAGT,KADA,EAAoB,IAAI,MAAM,GAAmB,IAE/C,OAAO,EAGT,GAAI,EAAkB,WAAa,EAAkB,UACnD,EAAkB,OAAS,EAAkB,MAC7C,EAAkB,WAAa,EAAkB,SACjD,OAAO,EAKT,IAAK,IAAI,KAAS,EAAkB,MAClC,GAAI,eAAe,EAAkB,MAAO,IAAU,EAAkB,MAAM,KAAW,EAAkB,MAAM,GAC/G,OAAO,EAIX,OAAO,CACT,EAEI,qBAAuB,SAAU,EAAQ,EAAU,EAAW,EAAY,GAC5E,IAAI,EAAiB,mBAAmB,GACxC,OAAI,EACK,EAAS,CAAE,QAAS,GAAkB,CAAE,eAAe,IAG3D,wCAAwC,GAIxC,YAAY,QAIjB,6BAA6B,EAAQ,EAAW,EAAY,GAAQ,SAAU,EAAO,GACnF,OAAO,EAAS,EAAO,EACzB,IALS,EAAS,CAAE,QAAS,8BAJpB,EAAS,CAAE,QAAS,2CAU/B,EAEI,mBAAqB,SAAU,GACjC,OAAK,OAAO,GAGsB,SAAzB,EAAO,eACP,EAAO,gBAEkB,UAAzB,EAAO,eACP,2BAGF,KATE,gCAUX,EAEI,wCAA0C,SAAU,GACtD,QAA0B,QAAtB,EAAiB,UAAe,OAAO,EAAO,+BAC3C,OAAO,kBAAkB,EAAO,6BAMzC,EAEI,YAAc,SAAU,GAC1B,IAAK,OAAO,EAAO,cACjB,OAAO,EAET,IAAK,OAAO,EAAO,0BACjB,OAAO,EAGT,IAAI,EAAQ,EAAO,yBACf,EAAe,EAAM,QAAQ,KACjC,IAAqB,GAAjB,EACF,OAAO,EAIT,IAAI,EAAY,IAAI,KAAK,KAAK,MAAM,EAAM,UAAU,EAAG,EAAe,KACtE,MAAkD,kBAA9C,OAAO,UAAU,SAAS,KAAK,KAAkC,MAAM,KAK3E,qBAGI,KAAK,KAAI,IAAI,MAAO,UAAY,EAAU,WAAa,QAKvD,OAAO,QAAQ,MAKnB,QAAQ,GAAS,GACV,IACT,EAEI,iBAAmB,WACrB,IAAK,IAAI,KAAS,QACZ,eAAe,QAAS,IAAU,KAAK,KAAI,IAAI,MAAO,UAAY,QAAQ,GAAO,WAAa,YACzF,QAAQ,EAGrB,EAEI,6BAA+B,SAAU,EAAQ,EAAW,EAAY,EAAQ,GAClF,IAAI,EAAoB,EAAO,qBAC3B,GAA0B,EAC9B,IAAK,OAAO,GAAoB,CAC9B,GAAK,OAAO,EAAO,cAUjB,OAAO,EAAS,KAAM,CAAE,eAAe,IANvC,GAA0B,CAQ9B,CAEI,IACF,EAAoB,EAAO,oBAG7B,EAAoB,+BAA+B,GACnD,OAAO,0BAA0B,GAAmB,SAAU,EAAO,GACnE,OAAI,EACK,EAAS,CAAE,QAAS,iGAGzB,EACK,iCAAiC,CAAC,GAAW,EAAQ,EAAW,EAAY,GAE5E,EACA,EAAS,CAAE,QAAS,sKAG7B,OAAO,SAAS,EAAmB,GAAQ,SAAU,EAAO,GAC1D,OAAI,EACK,EAAS,GAEb,GAAc,EAAU,YAI7B,iCAAiC,EAAW,EAAQ,EAAW,EAAY,GAHlE,EAAS,CAAE,QAAS,yEAI/B,GACF,GACF,EAEI,iCAAmC,SAAU,EAAW,EAAQ,EAAW,EAAY,GACzF,IAAK,IAAI,EAAI,EAAG,EAAI,EAAU,SAAU,EAAG,CACzC,IAAI,EAAW,EAAU,GACzB,IAAM,EAAO,cAAkB,EAAS,SAA6D,IAAlD,EAAS,QAAQ,QAAQ,EAAO,cAAnF,CAIA,GAAM,EAAS,UAAgD,IAArC,EAAS,QAAQ,QAAQ,OAAe,CAChE,IAAI,EAAW,EAAO,sBACtB,GAAI,EAAS,UAAY,EACvB,SAEF,GAAI,EAAS,kBAAmB,CAC9B,IAAI,EAAoB,+BAA+B,EAAO,sBAC9D,GAAI,EAAS,mBAAqB,EAChC,OAAO,EAAS,CAAE,QAAS,yFAE/B,CACF,CAEA,OAAM,EAAS,iBAAmB,EAAS,iBAAmB,EAAO,mBAC5D,EAAS,CAAE,QAAS,8EAGtB,gBAAgB,EAAQ,EAAU,GAAW,SAAU,EAAO,GACnE,GAAI,EACF,OAAO,EAAS,GAElB,GAAI,GAAc,EAAO,cACvB,IAAK,IAAI,KAAO,EAAY,CAC1B,GAAK,eAAe,EAAY,GAGjB,EAAW,GACjB,WAAW,EAAQ,EAC9B,CAGF,OAAO,EAAS,KAAM,EACxB,GAlCA,CAmCF,CAEA,EAAS,CAAE,QAAS,0EACtB,EAEI,gBAAkB,SAAU,EAAQ,EAAU,EAAW,GAC3D,IAAK,OAAO,EAAO,oBAChB,OAAO,EAAO,eACf,OAAO,EAAS,CAAE,QAAS,4BAA8B,CAAE,eAAe,IAGxE,EACF,6BAA6B,EAAQ,EAAU,GAG/C,gCAAgC,EAAQ,EAE5C,EAEI,gCAAkC,SAAU,EAAQ,GACtD,IAAK,OAAO,EAAO,wBACjB,OAAO,EAAS,CAAE,QAAS,+HAE7B,OAAO,gBAAgB,EAAO,wBAAwB,SAAU,EAAO,GACrE,GAAI,EACF,OAAO,EAAS,CAAE,QAAS,6BAA+B,CAAE,eAAe,IAE7E,IAAK,EACH,OAAO,EAAS,CAAE,QAAS,8BAAgC,CAAE,eAAe,IAE9E,IAAqD,IAAjD,EAAY,SAAS,QAAQ,QAAQ,QAAiB,EAAY,SAAS,WAAa,EAAO,sBACjG,OAAO,EAAS,CAAE,QAAS,uDAAyD,CAAE,eAAe,IAKvG,IAFA,IAAI,EAAU,GACV,EAAe,EAAO,iBAAiB,MAAM,KACxC,EAAI,EAAG,EAAI,EAAa,OAAQ,IAAK,CAC5C,IAAI,EAAQ,EAAa,GACrB,EAAQ,EAAO,UAAY,GAC/B,IAAK,OAAO,GACV,OAAO,EAAS,CAAE,QAAS,2EAA6E,CAAE,eAAe,IAE3H,GAAW,EAAQ,IAAM,EAAQ,IACnC,CAEA,IAAI,EAAO,OAAO,WAAW,EAAY,KAAM,QAAQ,EAAY,OAAQ,WAC3E,EAAK,OAAO,EAAS,QACF,EAAK,OAAO,WAEX,EAAO,cACzB,EAAS,KAAM,CAAE,eAAe,EAAM,mBAAoE,IAAjD,EAAY,SAAS,QAAQ,QAAQ,OAAgB,EAAO,qBAAuB,EAAY,SAAS,oBAGjK,EAAS,CAAE,QAAS,qBAAuB,CAAE,eAAe,GAEhE,GACF,EAEI,6BAA+B,SAAU,EAAQ,EAAU,GAC7D,IAAI,EACJ,CACE,cAAe,wBAEjB,IAAK,IAAI,KAAO,EACV,eAAe,EAAQ,IAAe,eAAP,IACjC,EAAc,GAAO,EAAO,IAIhC,MAAM,OAAO,EAAO,eAAiB,EAAO,uBAA8C,EAAS,SAAU,GAAe,SAAU,EAAM,EAAS,GACnJ,OAAkB,KAAd,GAA6B,MAAR,EAChB,EAAS,CAAE,QAAS,4CAA8C,CAAE,eAAe,IAIlE,SADxB,EAAO,gBAAgB,IACJ,SACV,EAAS,KAAM,CAAE,eAAe,EAAM,mBAAwD,IAArC,EAAS,QAAQ,QAAQ,OAAgB,EAAO,qBAAuB,EAAO,qBAGvI,EAAS,CAAE,QAAS,qBAAuB,CAAE,eAAe,GAGzE,GAEF,EAGI,+BAAiC,SAAU,GAC7C,IAAK,EACH,OAAO,EAGT,IAAI,EAAQ,EAAkB,QAAQ,KACtC,OAAe,IAAX,EACK,EAAkB,UAAU,EAAG,GAGjC,CACT,EAOI,mBAAqB,SAAU,EAAQ,GACzC,IAAK,IAAI,KAAK,EACZ,GAAI,EAAO,IAAM,EACf,OAAO,EAAE,QAAQ,aAAc,GACrC,EAOI,UAAY,CAAC,WAAY,QAAS,WAAY,MAAO,SAAU,WAAY,UAAW,WAAY,YAEtG,OAAO,mBAAqB,SAA4B,GACtD,KAAK,cAAgB,CAAE,iBAAkB,yCACrC,EAAQ,aACV,KAAK,cAAc,0BAA4B,EAAQ,YAGzD,IAFA,IAAI,EAAW,GACX,EAAW,GACN,EAAI,EAAG,EAAI,UAAU,OAAQ,IAAK,CACzC,IAAI,EAAM,UAAU,GAChB,EAAQ,KACU,YAAhB,EAAQ,GACV,EAAS,KAAK,GAGd,EAAS,KAAK,IAGd,EAAS,SACX,KAAK,cAAc,wBAA0B,EAAS,KAAK,MAEzD,EAAS,SACX,KAAK,cAAc,wBAA0B,EAAS,KAAK,KAE/D,CACF,EAEA,OAAO,mBAAmB,UAAU,WAAa,SAAU,EAAQ,GAEjE,IADA,IAAI,EAAY,mBAAmB,EAAQ,0CAA4C,OAC9E,EAAI,EAAG,EAAI,UAAU,OAAQ,IAAK,CACzC,IAAI,EAAM,UAAU,GAChB,EAAO,UAAY,EAAY,IAAM,KACvC,EAAO,GAAO,EAAO,UAAY,EAAY,IAAM,GAEvD,CACF,EAMA,OAAO,cAAgB,SAAuB,GAM5C,IAAK,IAAI,IALe,iBAAb,IACT,EAAU,CAAE,KAAM,GAAW,UAG/B,KAAK,cAAgB,CAAE,eAAgB,6CACzB,EACZ,KAAK,cAAc,aAAe,GAAK,EAAQ,EAEnD,EAEA,OAAO,cAAc,UAAU,WAAa,SAAU,EAAQ,GAE9D,EAUA,IAAI,iBACJ,CACE,2CAA4C,UAC1C,oCAAqC,QACrC,uCAAwC,YACxC,oCAAqC,WACrC,sCAAuC,WAEvC,0CAA2C,WAC3C,iCAAkC,YAGtC,OAAO,kBAAoB,SAA2B,GACpD,KAAK,cAAgB,CACnB,eAAgB,+BAChB,iBAAkB,iBAEpB,IAAI,EAAW,GACX,EAAW,GACf,IAAK,IAAI,KAAM,EACR,eAAe,EAAS,KACV,YAAf,EAAQ,GACV,EAAS,KAAK,GAGd,EAAS,KAAK,IAGlB,IAAI,EAAO,KACX,EAAW,EAAS,KAAI,SAAU,EAAI,GACpC,IAAI,EAAO,iBAAiB,IAAO,MAAQ,EAE3C,OADA,EAAK,cAAc,kBAAoB,GAAQ,EACxC,CACT,IACA,EAAW,EAAS,KAAI,SAAU,EAAI,GACpC,IAAI,EAAO,iBAAiB,IAAO,MAAQ,EAE3C,OADA,EAAK,cAAc,kBAAoB,GAAQ,EACxC,CACT,IACI,EAAS,SACX,KAAK,cAAc,sBAAwB,EAAS,KAAK,MAEvD,EAAS,SACX,KAAK,cAAc,0BAA4B,EAAS,KAAK,KAEjE,EAEA,OAAO,kBAAkB,UAAU,WAAa,SAAU,EAAQ,GAChE,IAAI,EAAY,mBAAmB,EAAQ,iCAAmC,KAC1E,EAAQ,IAAI,OAAO,aAAe,EAAY,mDAC9C,EAAU,CAAC,EACX,EAAW,CAAC,EACZ,EAAS,CAAC,EACd,IAAK,IAAI,KAAK,EACZ,GAAK,eAAe,EAAQ,GAA5B,CACA,IAAI,EAAU,EAAE,MAAM,GACtB,GAAK,EAGL,GAAkB,QAAd,EAAQ,GACV,EAAQ,EAAO,IAAM,EAAQ,QAE1B,GAAkB,SAAd,EAAQ,GAAe,CAE9B,IAAI,EAAQ,SAAS,EAAO,GAAI,IAGhC,EAAS,EAAQ,IAAO,EAAQ,oBAAuB,EAAQ,mBACjE,KACK,CACH,GAAI,EAAQ,IAIN,EAAQ,SAAS,EAAQ,GAAI,KAGrB,GAAK,IAAU,EAAS,EAAQ,KAAO,uBAC5C,EAAO,EAAQ,MAClB,EAAO,EAAQ,IAAM,IAEvB,EAAO,EAAQ,IAAI,EAAQ,GAAK,EAAO,SAKzC,EAAO,EAAQ,IAAM,EAAO,EAEhC,CAlC4C,CAoC9C,IAAK,IAAI,KAAM,EACT,EAAQ,KAAO,IACjB,EAAO,EAAQ,IAAO,EAAO,EAAQ,IACrC,EAAO,GAAM,EAAO,EAAQ,IAGlC,EAEA,OAAO,YAAc,SAAU,GAC7B,KAAK,cAAgB,CACnB,kBAAmB,+CACnB,wBAAyB,EAAqB,YAC9C,qBAAsB,EAAe,MAEzC,EAEA,OAAO,YAAY,UAAU,WAAa,SAAU,EAAQ,GAC1D,IACI,EAAa,WADD,mBAAmB,EAAQ,iDAAmD,SACrD,sBAGd,IAAvB,EAAO,KACT,EAAsB,cAAI,EAAO,GAErC,EAgBA,IAAI,kBAAoB,CAAC,eAAgB,0BAA2B,8BAChE,mBAAqB,CAAC,gBAAiB,aAGvC,kBACJ,CACE,qBAAsB,qEACtB,eAAgB,+DAChB,wBAAyB,wEACzB,KAAQ,wDAGV,OAAO,KAAO,SAAc,GAE1B,IAAK,IAAI,KADT,KAAK,cAAgB,CAAE,iBAAkB,+CAC3B,EAEV,KAAK,cAAc,eAAiB,GAD5B,4BAAN,EACuC,mBAAmB,EAAQ,IAE3B,EAAQ,GAG1C,QAAQ,OACrB,EAKA,IAAI,mBAAqB,SAAU,GAEjC,IADA,IAAI,EAAW,EAAY,MAAM,KACxB,EAAI,EAAG,EAAI,EAAS,OAAQ,IAC/B,EAAS,KAAM,oBACjB,EAAS,GAAK,kBAAkB,EAAS,KAG7C,OAAO,EAAS,KAAK,IACvB,EAEI,oBAAsB,SAAU,GAElC,IADA,IAAI,EAAW,EAAY,MAAM,KACxB,EAAI,EAAG,EAAI,EAAS,OAAQ,IACnC,IAAK,aAAa,kBACZ,kBAAkB,aAAe,EAAS,KAC5C,EAAS,GAAK,WAIpB,OAAO,EAAS,KAAK,IACvB,EAEA,OAAO,KAAK,UAAU,WAAa,SAAU,EAAQ,GACnD,IAEI,EADA,EAAc,WADF,mBAAmB,EAAQ,gDAAkD,QACnD,IAE1C,IAAK,IAAI,KAAK,EACR,eAAe,EAAQ,IACrB,EAAE,OAAO,EAAG,EAAY,UAAY,IAGpC,EAFF,EAAY,EAAE,OAAO,EAAY,SACf,kBAAd,EACkB,oBAAoB,EAAO,IAE3B,EAAO,GAKrC","file":"/npm/openid@2.0.15/openid.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/openid@2.0.15/openid.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","/* OpenID for node.js\n *\n * http://ox.no/software/node-openid\n * http://github.com/havard/node-openid\n *\n * Copyright (C) 2010 by Håvard Stranden\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in\n * all copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\n *\n * -*- Mode: JS; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- \n * vim: set sw=2 ts=2 et tw=80 : \n */\n\nconst { access } = require('fs');\n\nvar Buffer = require('buffer').Buffer,\n  crypto = require('crypto'),\n  http = require('./http'),\n  querystring = require('querystring'),\n  url = require('url'),\n  xrds = require('./lib/xrds');\n\nvar _associations = {};\nvar _discoveries = {};\nvar _nonces = {};\n\nvar AX_MAX_VALUES_COUNT = 1000;\n\nvar openid = exports;\n\nvar _get = http.get;\nvar _post = http.post;\n\nfunction hasOwnProperty(obj, prop) {\n  return Object.prototype.hasOwnProperty.call(obj, prop);\n}\n\nopenid.RelyingParty = function (returnUrl, realm, stateless, strict, extensions) {\n  this.returnUrl = returnUrl;\n  this.realm = realm || null;\n  this.stateless = stateless;\n  this.strict = strict;\n  this.extensions = extensions;\n}\n\nopenid.RelyingParty.prototype.authenticate = function (identifier, immediate, callback) {\n  openid.authenticate(identifier, this.returnUrl, this.realm,\n    immediate, this.stateless, callback, this.extensions, this.strict);\n}\n\nopenid.RelyingParty.prototype.verifyAssertion = function (requestOrUrl, callback) {\n  openid.verifyAssertion(requestOrUrl, this.returnUrl, callback, this.stateless, this.extensions, this.strict);\n}\n\n\n\nvar _btwoc = function (i) {\n  if (i.charCodeAt(0) > 127) {\n    return String.fromCharCode(0) + i;\n  }\n  return i;\n}\n\nvar _unbtwoc = function (i) {\n  if (i[0] === String.fromCharCode(0)) {\n    return i.substr(1);\n  }\n\n  return i;\n}\n\nvar _isDef = function (e) {\n  var undefined;\n  return e !== undefined;\n}\n\n// Find the most up-to-date and usable way to create buffers\nvar _buffer = null;\nif (typeof (Buffer.from) === 'function') {\n  // Some older Node versions throw an exception when \n  // buffers with binary encoding are created using the\n  // from function, so if that happens we have to resort\n  // to constructor based creation.\n  try {\n    Buffer.from('openid', 'binary');\n    _buffer = Buffer.from;\n  }\n  catch (_) {\n  }\n}\nif (_buffer === null) {\n  // Either the Node version is too old to have a Buffer.from,\n  // or the Buffer.from call failed with binary encoding.\n  // Either way, use the (deprecated from node v6) constructor.\n  _buffer = function (str, enc) { return new Buffer(str, enc); };\n}\n\nvar _base64encode = function (str) {\n  return _buffer(str, 'binary').toString('base64');\n};\n\nvar _base64decode = function (str) {\n  return _buffer(str, 'base64').toString('binary');\n};\n\nvar _bigIntToBase64 = function (binary) {\n  return _base64encode(_btwoc(binary));\n}\n\nvar _bigIntFromBase64 = function (str) {\n  return _unbtwoc(_base64decode(str));\n}\n\nvar _xor = function (a, b) {\n  if (a.length != b.length) {\n    throw new Error('Length must match for xor');\n  }\n\n  var r = '';\n  for (var i = 0; i < a.length; ++i) {\n    r += String.fromCharCode(a.charCodeAt(i) ^ b.charCodeAt(i));\n  }\n\n  return r;\n}\n\nopenid.saveAssociation = function (provider, type, handle, secret, expiry_time_in_seconds, callback) {\n  setTimeout(function () {\n    openid.removeAssociation(handle);\n  }, expiry_time_in_seconds * 1000);\n  _associations[handle] = { provider: provider, type: type, secret: secret };\n  callback(null); // Custom implementations may report error as first argument\n}\n\nopenid.loadAssociation = function (handle, callback) {\n  if (_isDef(_associations[handle])) {\n    callback(null, _associations[handle]);\n  }\n  else {\n    callback(null, null);\n  }\n}\n\nopenid.removeAssociation = function (handle) {\n  delete _associations[handle];\n  return true;\n}\n\nopenid.saveDiscoveredInformation = function (key, provider, callback) {\n  _discoveries[key] = provider;\n  return callback(null);\n}\n\nopenid.loadDiscoveredInformation = function (key, callback) {\n  if (!_isDef(_discoveries[key])) {\n    return callback(null, null);\n  }\n\n  return callback(null, _discoveries[key]);\n}\n\nvar _buildUrl = function (theUrl, params) {\n  theUrl = url.parse(theUrl, true);\n  delete theUrl['search'];\n  if (params) {\n    if (!theUrl.query) {\n      theUrl.query = params;\n    }\n    else {\n      for (var key in params) {\n        if (hasOwnProperty(params, key)) {\n          theUrl.query[key] = params[key];\n        }\n      }\n    }\n  }\n\n  return url.format(theUrl);\n}\nvar _decodePostData = function (data) {\n  var lines = data.split('\\n');\n  var result = {};\n  for (var i = 0; i < lines.length; i++) {\n    var line = lines[i];\n    if (line.length > 0 && line[line.length - 1] == '\\r') {\n      line = line.substring(0, line.length - 1);\n    }\n    var colon = line.indexOf(':');\n    if (colon === -1) {\n      continue;\n    }\n    var key = line.substr(0, line.indexOf(':'));\n    var value = line.substr(line.indexOf(':') + 1);\n    result[key] = value;\n  }\n\n  return result;\n}\nvar _normalizeIdentifier = function (identifier) {\n  identifier = identifier.replace(/^\\s+|\\s+$/g, '');\n  if (!identifier)\n    return null;\n  if (identifier.indexOf('xri://') === 0) {\n    identifier = identifier.substring(6);\n  }\n\n  if (/^[(=@\\+\\$!]/.test(identifier)) {\n    return identifier;\n  }\n\n  if (identifier.indexOf('http') === 0) {\n    return identifier;\n  }\n  return 'http://' + identifier;\n}\n\nvar _parseXrds = function (xrdsUrl, xrdsData) {\n  var services = xrds.parse(xrdsData);\n  if (services == null) {\n    return null;\n  }\n\n  var providers = [];\n  for (var i = 0, len = services.length; i < len; ++i) {\n    var service = services[i];\n    var provider = {};\n\n    provider.endpoint = service.uri;\n    if (/https?:\\/\\/xri./.test(xrdsUrl)) {\n      provider.claimedIdentifier = service.id;\n    }\n    if (service.type == 'http://specs.openid.net/auth/2.0/signon') {\n      provider.version = 'http://specs.openid.net/auth/2.0';\n      provider.localIdentifier = service.id;\n    }\n    else if (service.type == 'http://specs.openid.net/auth/2.0/server') {\n      provider.version = 'http://specs.openid.net/auth/2.0';\n    }\n    else if (service.type == 'http://openid.net/signon/1.0' ||\n      service.type == 'http://openid.net/signon/1.1') {\n      provider.version = service.type;\n      provider.localIdentifier = service.delegate;\n    }\n    else {\n      continue;\n    }\n    providers.push(provider);\n  }\n\n  return providers;\n}\n\nvar _matchMetaTag = function (html) {\n  var metaTagMatches = /<meta\\s+.*?http-equiv=\"x-xrds-location\"\\s+(.*?)>/ig.exec(html);\n  if (!metaTagMatches || metaTagMatches.length < 2) {\n    return null;\n  }\n\n  var contentMatches = /content=\"(.*?)\"/ig.exec(metaTagMatches[1]);\n  if (!contentMatches || contentMatches.length < 2) {\n    return null;\n  }\n\n  return contentMatches[1];\n}\n\nvar _matchLinkTag = function (html, rel) {\n  var providerLinkMatches = new RegExp('<link\\\\s+.*?rel=[\"\\'][^\"\\']*?' + rel + '[^\"\\']*?[\"\\'].*?>', 'ig').exec(html);\n\n  if (!providerLinkMatches || providerLinkMatches.length < 1) {\n    return null;\n  }\n\n  var href = /href=[\"'](.*?)[\"']/ig.exec(providerLinkMatches[0]);\n\n  if (!href || href.length < 2) {\n    return null;\n  }\n  return href[1];\n}\n\nvar _parseHtml = function (htmlUrl, html, callback, hops) {\n  var metaUrl = _matchMetaTag(html);\n  if (metaUrl != null) {\n    return _resolveXri(metaUrl, callback, hops + 1);\n  }\n\n  var provider = _matchLinkTag(html, 'openid2.provider');\n  if (provider == null) {\n    provider = _matchLinkTag(html, 'openid.server');\n    if (provider == null) {\n      callback(null);\n    }\n    else {\n      var localId = _matchLinkTag(html, 'openid.delegate');\n      callback([{\n        version: 'http://openid.net/signon/1.1',\n        endpoint: provider,\n        claimedIdentifier: htmlUrl,\n        localIdentifier: localId\n      }]);\n    }\n  }\n  else {\n    var localId = _matchLinkTag(html, 'openid2.local_id');\n    callback([{\n      version: 'http://specs.openid.net/auth/2.0/signon',\n      endpoint: provider,\n      claimedIdentifier: htmlUrl,\n      localIdentifier: localId\n    }]);\n  }\n}\n\nvar _parseHostMeta = function (hostMeta, callback) {\n  var match = /^Link: <([^\\n\\r]+?)>;/.exec(hostMeta);\n  if (match != null && match.length > 0) {\n    var xriUrl = match[1];\n    _resolveXri(xriUrl, callback);\n  }\n  else {\n    callback(null);\n  }\n}\n\nvar _resolveXri = function (xriUrl, callback, hops) {\n  if (!hops) {\n    hops = 1;\n  }\n  else if (hops >= 5) {\n    return callback(null);\n  }\n\n  _get(xriUrl, null, function (data, headers, statusCode) {\n    if (statusCode != 200) {\n      return callback(null);\n    }\n\n    var xrdsLocation = headers['x-xrds-location'];\n    if (_isDef(xrdsLocation)) {\n      _get(xrdsLocation, null, function (data, headers, statusCode) {\n        if (statusCode != 200 || data == null) {\n          callback(null);\n        }\n        else {\n          callback(_parseXrds(xrdsLocation, data));\n        }\n      });\n    }\n    else if (data != null) {\n      var contentType = headers['content-type'];\n      // text/xml is not compliant, but some hosting providers refuse header\n      // changes, so text/xml is encountered\n      if (contentType && (contentType.indexOf('application/xrds+xml') === 0 || contentType.indexOf('text/xml') === 0)) {\n        return callback(_parseXrds(xriUrl, data));\n      }\n      else {\n        return _resolveHtml(xriUrl, callback, hops + 1, data);\n      }\n    }\n  });\n}\n\nvar _resolveHtml = function (identifier, callback, hops, data) {\n  if (!hops) {\n    hops = 1;\n  }\n  else if (hops >= 5) {\n    return callback(null);\n  }\n\n  if (data == null) {\n    _get(identifier, null, function (data, headers, statusCode) {\n      if (statusCode != 200 || data == null) {\n        callback(null);\n      }\n      else {\n        _parseHtml(identifier, data, callback, hops + 1);\n      }\n    });\n  }\n  else {\n    _parseHtml(identifier, data, callback, hops);\n  }\n\n}\n\nvar _resolveHostMeta = function (identifier, strict, callback, fallBackToProxy) {\n  var host = url.parse(identifier);\n  var hostMetaUrl;\n  if (fallBackToProxy && !strict) {\n    hostMetaUrl = 'https://www.google.com/accounts/o8/.well-known/host-meta?hd=' + host.host;\n  }\n  else {\n    hostMetaUrl = host.protocol + '//' + host.host + '/.well-known/host-meta';\n  }\n  if (!hostMetaUrl) {\n    callback(null);\n  }\n  else {\n    _get(hostMetaUrl, null, function (data, headers, statusCode) {\n      if (statusCode != 200 || data == null) {\n        if (!fallBackToProxy && !strict) {\n          _resolveHostMeta(identifier, strict, callback, true);\n        }\n        else {\n          callback(null);\n        }\n      }\n      else {\n        //Attempt to parse the data but if this fails it may be because\n        //the response to hostMetaUrl was some other http/html resource.\n        //Therefore fallback to the proxy if no providers are found.\n        _parseHostMeta(data, function (providers) {\n          if ((providers == null || providers.length == 0) && !fallBackToProxy && !strict) {\n            _resolveHostMeta(identifier, strict, callback, true);\n          }\n          else {\n            callback(providers);\n          }\n        });\n      }\n    });\n  }\n}\n\nopenid.discover = function (identifier, strict, callback) {\n  identifier = _normalizeIdentifier(identifier);\n  if (!identifier) {\n    return callback({ message: 'Invalid identifier' }, null);\n  }\n  if (identifier.indexOf('http') !== 0) {\n    // XRDS\n    identifier = 'https://xri.net/' + identifier + '?_xrd_r=application/xrds%2Bxml';\n  }\n\n  // Try XRDS/Yadis discovery\n  _resolveXri(identifier, function (providers) {\n    if (providers == null || providers.length == 0) {\n      // Fallback to HTML discovery\n      _resolveHtml(identifier, function (providers) {\n        if (providers == null || providers.length == 0) {\n          _resolveHostMeta(identifier, strict, function (providers) {\n            callback(null, providers);\n          });\n        }\n        else {\n          callback(null, providers);\n        }\n      });\n    }\n    else {\n      // Add claimed identifier to providers with local identifiers\n      // and OpenID 1.0/1.1 providers to ensure correct resolution \n      // of identities and services\n      for (var i = 0, len = providers.length; i < len; ++i) {\n        var provider = providers[i];\n        if (!provider.claimedIdentifier &&\n          (provider.localIdentifier || provider.version.indexOf('2.0') === -1)) {\n          provider.claimedIdentifier = identifier;\n        }\n      }\n      callback(null, providers);\n    }\n  });\n}\n\nvar _createDiffieHellmanKeyExchange = function (algorithm) {\n  var defaultPrime = 'ANz5OguIOXLsDhmYmsWizjEOHTdxfo2Vcbt2I3MYZuYe91ouJ4mLBX+YkcLiemOcPym2CBRYHNOyyjmG0mg3BVd9RcLn5S3IHHoXGHblzqdLFEi/368Ygo79JRnxTkXjgmY0rxlJ5bU1zIKaSDuKdiI+XUkKJX8Fvf8W8vsixYOr';\n\n  var dh = crypto.createDiffieHellman(defaultPrime, 'base64');\n\n  dh.generateKeys();\n\n  return dh;\n}\n\nopenid.associate = function (provider, callback, strict, algorithm) {\n  var associationParameters = _generateAssociationRequestParameters(provider.version, algorithm);\n  algorithm = associationParameters.algorithm;\n  var params = associationParameters.params;\n\n  var dh = null;\n  if (algorithm.indexOf('no-encryption') === -1) {\n    dh = _createDiffieHellmanKeyExchange(algorithm);\n    params['openid.dh_modulus'] = _bigIntToBase64(dh.getPrime('binary'));\n    params['openid.dh_gen'] = _bigIntToBase64(dh.getGenerator('binary'));\n    params['openid.dh_consumer_public'] = _bigIntToBase64(dh.getPublicKey('binary'));\n  }\n\n  _post(provider.endpoint, params, function (data, headers, statusCode) {\n    if ((statusCode != 200 && statusCode != 400) || data === null) {\n      return callback({\n        message: 'HTTP request failed'\n      }, {\n        error: 'HTTP request failed',\n        error_code: '' + statusCode,\n        ns: 'http://specs.openid.net/auth/2.0'\n      });\n    }\n\n    data = _decodePostData(data);\n\n    if (data.error_code == 'unsupported-type' || (provider.version.indexOf('2.0') !== -1 && !_isDef(data.ns))) {\n      if (algorithm == 'DH-SHA1') {\n        if (strict && provider.endpoint.toLowerCase().indexOf('https:') !== 0) {\n          return callback({ message: 'Channel is insecure and no encryption method is supported by provider' }, null);\n        }\n        else {\n          return openid.associate(provider, callback, strict, 'no-encryption-256');\n        }\n      }\n      else if (algorithm == 'no-encryption-256') {\n        if (strict && provider.endpoint.toLowerCase().indexOf('https:') !== 0) {\n          return callback('Channel is insecure and no encryption method is supported by provider', null);\n        }\n        /*else if(provider.version.indexOf('2.0') === -1)\n        {\n          // 2011-07-22: This is an OpenID 1.0/1.1 provider which means\n          // HMAC-SHA1 has already been attempted with a blank session\n          // type as per the OpenID 1.0/1.1 specification.\n          // (See http://openid.net/specs/openid-authentication-1_1.html#mode_associate)\n          // However, providers like wordpress.com don't follow the \n          // standard and reject these requests, but accept OpenID 2.0\n          // style requests without a session type, so we have to give\n          // those a shot as well.\n          callback({ message: 'Provider is OpenID 1.0/1.1 and does not support OpenID 1.0/1.1 association.' });\n        }*/\n        else {\n          return openid.associate(provider, callback, strict, 'no-encryption');\n        }\n      }\n      else if (algorithm == 'DH-SHA256') {\n        return openid.associate(provider, callback, strict, 'DH-SHA1');\n      }\n    }\n\n    if (data.error) {\n      callback({ message: data.error }, data);\n    }\n    else {\n      var secret = null;\n\n      var hashAlgorithm = algorithm.indexOf('256') !== -1 ? 'sha256' : 'sha1';\n\n      if (algorithm.indexOf('no-encryption') !== -1) {\n        secret = data.mac_key;\n      }\n      else {\n        var serverPublic = _bigIntFromBase64(data.dh_server_public);\n        var sharedSecret = _btwoc(dh.computeSecret(serverPublic, 'binary', 'binary'));\n        var hash = crypto.createHash(hashAlgorithm);\n        hash.update(_buffer(sharedSecret, 'binary'));\n        sharedSecret = hash.digest('binary');\n        var encMacKey = _base64decode(data.enc_mac_key);\n        secret = _base64encode(_xor(encMacKey, sharedSecret));\n      }\n\n      if (!_isDef(data.assoc_handle)) {\n        return callback({ message: 'OpenID provider does not seem to support association; you need to use stateless mode' }, null);\n      }\n\n      openid.saveAssociation(provider, hashAlgorithm,\n        data.assoc_handle, secret, data.expires_in * 1, function (error) {\n          if (error) {\n            return callback(error);\n          }\n          callback(null, data);\n        });\n    }\n  });\n}\n\nvar _generateAssociationRequestParameters = function (version, algorithm) {\n  var params = {\n    'openid.mode': 'associate',\n  };\n\n  if (version.indexOf('2.0') !== -1) {\n    params['openid.ns'] = 'http://specs.openid.net/auth/2.0';\n  }\n\n  if (version.indexOf('2.0') === -1 || algorithm == 'DH-SHA1') {\n    algorithm = 'DH-SHA1';\n    params['openid.assoc_type'] = 'HMAC-SHA1';\n    params['openid.session_type'] = 'DH-SHA1';\n  }\n  else if (algorithm == 'no-encryption-256') {\n    if (version.indexOf('2.0') === -1) {\n      params['openid.session_type'] = ''; // OpenID 1.0/1.1 requires blank\n      params['openid.assoc_type'] = 'HMAC-SHA1';\n    }\n    else {\n      params['openid.session_type'] = 'no-encryption';\n      params['openid.assoc_type'] = 'HMAC-SHA256';\n    }\n  }\n  else if (algorithm == 'no-encryption') {\n    if (version.indexOf('2.0') !== -1) {\n      params['openid.session_type'] = 'no-encryption';\n    }\n    params['openid.assoc_type'] = 'HMAC-SHA1';\n  }\n  else {\n    algorithm = 'DH-SHA256';\n    params['openid.assoc_type'] = 'HMAC-SHA256';\n    params['openid.session_type'] = 'DH-SHA256';\n  }\n\n  return { algorithm: algorithm, params: params };\n}\n\nopenid.authenticate = function (identifier, returnUrl, realm, immediate, stateless, callback, extensions, strict) {\n  openid.discover(identifier, strict, function (error, providers) {\n    if (error) {\n      return callback(error);\n    }\n    if (!providers || providers.length === 0) {\n      return callback({ message: 'No providers found for the given identifier' }, null);\n    }\n\n    var providerIndex = -1;\n\n    (function chooseProvider(error, authUrl) {\n      if (!error && authUrl) {\n        var provider = providers[providerIndex];\n\n        if (provider.claimedIdentifier) {\n          var useLocalIdentifierAsKey = provider.version.indexOf('2.0') === -1 && provider.localIdentifier && provider.claimedIdentifier != provider.localIdentifier;\n\n          return openid.saveDiscoveredInformation(useLocalIdentifierAsKey ? provider.localIdentifier : provider.claimedIdentifier,\n            provider, function (error) {\n              if (error) {\n                return callback(error);\n              }\n              return callback(null, authUrl);\n            });\n        }\n        else if (provider.version.indexOf('2.0') !== -1) {\n          return callback(null, authUrl);\n        }\n        else {\n          chooseProvider({ message: 'OpenID 1.0/1.1 provider cannot be used without a claimed identifier' });\n        }\n      }\n      if (++providerIndex >= providers.length) {\n        return callback({ message: 'No usable providers found for the given identifier' }, null);\n      }\n\n      var currentProvider = providers[providerIndex];\n      if (stateless) {\n        _requestAuthentication(currentProvider, null, returnUrl,\n          realm, immediate, extensions || {}, chooseProvider);\n      }\n\n      else {\n        openid.associate(currentProvider, function (error, answer) {\n          if (error || !answer || answer.error) {\n            chooseProvider(error || answer.error, null);\n          }\n          else {\n            _requestAuthentication(currentProvider, answer.assoc_handle, returnUrl,\n              realm, immediate, extensions || {}, chooseProvider);\n          }\n        });\n\n      }\n    })();\n  });\n}\n\nvar _requestAuthentication = function (provider, assoc_handle, returnUrl, realm, immediate, extensions, callback) {\n  var params = {\n    'openid.mode': immediate ? 'checkid_immediate' : 'checkid_setup'\n  };\n\n  if (provider.version.indexOf('2.0') !== -1) {\n    params['openid.ns'] = 'http://specs.openid.net/auth/2.0';\n  }\n\n  for (var i in extensions) {\n    if (!hasOwnProperty(extensions, i)) {\n      continue;\n    }\n\n    var extension = extensions[i];\n    for (var key in extension.requestParams) {\n      if (!hasOwnProperty(extension.requestParams, key)) { continue; }\n      params[key] = extension.requestParams[key];\n    }\n  }\n\n  if (provider.claimedIdentifier) {\n    params['openid.claimed_id'] = provider.claimedIdentifier;\n    if (provider.localIdentifier) {\n      params['openid.identity'] = provider.localIdentifier;\n    }\n    else {\n      params['openid.identity'] = provider.claimedIdentifier;\n    }\n  }\n  else if (provider.version.indexOf('2.0') !== -1) {\n    params['openid.claimed_id'] = params['openid.identity'] =\n      'http://specs.openid.net/auth/2.0/identifier_select';\n  }\n  else {\n    return callback({ message: 'OpenID 1.0/1.1 provider cannot be used without a claimed identifier' });\n  }\n\n  if (assoc_handle) {\n    params['openid.assoc_handle'] = assoc_handle;\n  }\n\n  if (returnUrl) {\n    // Value should be missing if RP does not want\n    // user to be sent back\n    params['openid.return_to'] = returnUrl;\n  }\n\n  if (realm) {\n    if (provider.version.indexOf('2.0') !== -1) {\n      params['openid.realm'] = realm;\n    }\n    else {\n      params['openid.trust_root'] = realm;\n    }\n  }\n  else if (!returnUrl) {\n    return callback({ message: 'No return URL or realm specified' });\n  }\n\n  callback(null, _buildUrl(provider.endpoint, params));\n}\n\nopenid.verifyAssertion = function (requestOrUrl, originalReturnUrl, callback, stateless, extensions, strict) {\n  extensions = extensions || {};\n  var assertionUrl = requestOrUrl;\n  if (typeof (requestOrUrl) !== typeof ('')) {\n    if (requestOrUrl.method.toUpperCase() == 'POST') {\n      if ((requestOrUrl.headers['content-type'] || '').toLowerCase().indexOf('application/x-www-form-urlencoded') === 0) {\n        // POST response received\n        var data = '';\n\n        requestOrUrl.on('data', function (chunk) {\n          data += chunk;\n        });\n\n        requestOrUrl.on('end', function () {\n          var params = querystring.parse(data);\n          return _verifyAssertionData(params, callback, stateless, extensions, strict);\n        });\n      }\n      else {\n        return callback({ message: 'Invalid POST response from OpenID provider' });\n      }\n\n      return; // Avoid falling through to GET method assertion\n    }\n    else if (requestOrUrl.method.toUpperCase() != 'GET') {\n      return callback({ message: 'Invalid request method from OpenID provider' });\n    }\n    assertionUrl = requestOrUrl.url;\n  }\n\n  assertionUrl = url.parse(assertionUrl, true);\n  var params = assertionUrl.query;\n\n  if (!_verifyReturnUrl(assertionUrl, originalReturnUrl)) {\n    return callback({ message: 'Invalid return URL' });\n  }\n  return _verifyAssertionData(params, callback, stateless, extensions, strict);\n}\n\nvar _verifyReturnUrl = function (assertionUrl, originalReturnUrl) {\n  var receivedReturnUrl = assertionUrl.query['openid.return_to'];\n  if (!_isDef(receivedReturnUrl)) {\n    return false;\n  }\n\n  receivedReturnUrl = url.parse(receivedReturnUrl, true);\n  if (!receivedReturnUrl) {\n    return false;\n  }\n  originalReturnUrl = url.parse(originalReturnUrl, true);\n  if (!originalReturnUrl) {\n    return false;\n  }\n\n  if (originalReturnUrl.protocol !== receivedReturnUrl.protocol || // Verify scheme against original return URL\n    originalReturnUrl.host !== receivedReturnUrl.host || // Verify authority against original return URL\n    originalReturnUrl.pathname !== receivedReturnUrl.pathname) { // Verify path against current request URL\n    return false;\n  }\n\n  // Any query parameters that are present in the \"openid.return_to\" URL MUST also be present \n  // with the same values in the URL of the HTTP request the RP received\n  for (var param in receivedReturnUrl.query) {\n    if (hasOwnProperty(receivedReturnUrl.query, param) && receivedReturnUrl.query[param] !== originalReturnUrl.query[param]) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\nvar _verifyAssertionData = function (params, callback, stateless, extensions, strict) {\n  var assertionError = _getAssertionError(params);\n  if (assertionError) {\n    return callback({ message: assertionError }, { authenticated: false });\n  }\n\n  if (!_invalidateAssociationHandleIfRequested(params)) {\n    return callback({ message: 'Unable to invalidate association handle' });\n  }\n\n  if (!_checkNonce(params)) {\n    return callback({ message: 'Invalid or replayed nonce' });\n  }\n\n  _verifyDiscoveredInformation(params, stateless, extensions, strict, function (error, result) {\n    return callback(error, result);\n  });\n};\n\nvar _getAssertionError = function (params) {\n  if (!_isDef(params)) {\n    return 'Assertion request is malformed';\n  }\n  else if (params['openid.mode'] == 'error') {\n    return params['openid.error'];\n  }\n  else if (params['openid.mode'] == 'cancel') {\n    return 'Authentication cancelled';\n  }\n\n  return null;\n}\n\nvar _invalidateAssociationHandleIfRequested = function (params) {\n  if (params['is_valid'] == 'true' && _isDef(params['openid.invalidate_handle'])) {\n    if (!openid.removeAssociation(params['openid.invalidate_handle'])) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\nvar _checkNonce = function (params) {\n  if (!_isDef(params['openid.ns'])) {\n    return true; // OpenID 1.1 has no nonce\n  }\n  if (!_isDef(params['openid.response_nonce'])) {\n    return false;\n  }\n\n  var nonce = params['openid.response_nonce'];\n  var timestampEnd = nonce.indexOf('Z');\n  if (timestampEnd == -1) {\n    return false;\n  }\n\n  // Check for valid timestamp in nonce\n  var timestamp = new Date(Date.parse(nonce.substring(0, timestampEnd + 1)));\n  if (Object.prototype.toString.call(timestamp) !== '[object Date]' || isNaN(timestamp)) {\n    return false;\n  }\n\n  // Remove old nonces from our store (nonces that are more skewed than 5 minutes)\n  _removeOldNonces();\n\n  // Check if nonce is skewed by more than 5 minutes\n  if (Math.abs(new Date().getTime() - timestamp.getTime()) > 300000) {\n    return false;\n  }\n\n  // Check if nonce is replayed\n  if (_isDef(_nonces[nonce])) {\n    return false;\n  }\n\n  // Store the nonce\n  _nonces[nonce] = timestamp;\n  return true;\n}\n\nvar _removeOldNonces = function () {\n  for (var nonce in _nonces) {\n    if (hasOwnProperty(_nonces, nonce) && Math.abs(new Date().getTime() - _nonces[nonce].getTime()) > 300000) {\n      delete _nonces[nonce];\n    }\n  }\n}\n\nvar _verifyDiscoveredInformation = function (params, stateless, extensions, strict, callback) {\n  var claimedIdentifier = params['openid.claimed_id'];\n  var useLocalIdentifierAsKey = false;\n  if (!_isDef(claimedIdentifier)) {\n    if (!_isDef(params['openid.ns'])) {\n      // OpenID 1.0/1.1 response without a claimed identifier\n      // We need to load discovered information using the\n      // local identifier\n      useLocalIdentifierAsKey = true;\n    }\n    else {\n      // OpenID 2.0+:\n      // If there is no claimed identifier, then the\n      // assertion is not about an identity\n      return callback(null, { authenticated: false });\n    }\n  }\n\n  if (useLocalIdentifierAsKey) {\n    claimedIdentifier = params['openid.identity'];\n  }\n\n  claimedIdentifier = _getCanonicalClaimedIdentifier(claimedIdentifier);\n  openid.loadDiscoveredInformation(claimedIdentifier, function (error, provider) {\n    if (error) {\n      return callback({ message: 'An error occured when loading previously discovered information about the claimed identifier' });\n    }\n\n    if (provider) {\n      return _verifyAssertionAgainstProviders([provider], params, stateless, extensions, callback);\n    }\n    else if (useLocalIdentifierAsKey) {\n      return callback({ message: 'OpenID 1.0/1.1 response received, but no information has been discovered about the provider. It is likely that this is a fraudulent authentication response.' });\n    }\n\n    openid.discover(claimedIdentifier, strict, function (error, providers) {\n      if (error) {\n        return callback(error);\n      }\n      if (!providers || !providers.length) {\n        return callback({ message: 'No OpenID provider was discovered for the asserted claimed identifier' });\n      }\n\n      _verifyAssertionAgainstProviders(providers, params, stateless, extensions, callback);\n    });\n  });\n}\n\nvar _verifyAssertionAgainstProviders = function (providers, params, stateless, extensions, callback) {\n  for (var i = 0; i < providers.length; ++i) {\n    var provider = providers[i];\n    if (!!params['openid.ns'] && (!provider.version || provider.version.indexOf(params['openid.ns']) !== 0)) {\n      continue;\n    }\n\n    if (!!provider.version && provider.version.indexOf('2.0') !== -1) {\n      var endpoint = params['openid.op_endpoint'];\n      if (provider.endpoint != endpoint) {\n        continue;\n      }\n      if (provider.claimedIdentifier) {\n        var claimedIdentifier = _getCanonicalClaimedIdentifier(params['openid.claimed_id']);\n        if (provider.claimedIdentifier != claimedIdentifier) {\n          return callback({ message: 'Claimed identifier in assertion response does not match discovered claimed identifier' });\n        }\n      }\n    }\n\n    if (!!provider.localIdentifier && provider.localIdentifier != params['openid.identity']) {\n      return callback({ message: 'Identity in assertion response does not match discovered local identifier' });\n    }\n\n    return _checkSignature(params, provider, stateless, function (error, result) {\n      if (error) {\n        return callback(error);\n      }\n      if (extensions && result.authenticated) {\n        for (var ext in extensions) {\n          if (!hasOwnProperty(extensions, ext)) {\n            continue;\n          }\n          var instance = extensions[ext];\n          instance.fillResult(params, result);\n        }\n      }\n\n      return callback(null, result);\n    });\n  }\n\n  callback({ message: 'No valid providers were discovered for the asserted claimed identifier' });\n}\n\nvar _checkSignature = function (params, provider, stateless, callback) {\n  if (!_isDef(params['openid.signed']) ||\n    !_isDef(params['openid.sig'])) {\n    return callback({ message: 'No signature in response' }, { authenticated: false });\n  }\n\n  if (stateless) {\n    _checkSignatureUsingProvider(params, provider, callback);\n  }\n  else {\n    _checkSignatureUsingAssociation(params, callback);\n  }\n}\n\nvar _checkSignatureUsingAssociation = function (params, callback) {\n  if (!_isDef(params['openid.assoc_handle'])) {\n    return callback({ message: 'No association handle in provider response. Find out whether the provider supports associations and/or use stateless mode.' });\n  }\n  openid.loadAssociation(params['openid.assoc_handle'], function (error, association) {\n    if (error) {\n      return callback({ message: 'Error loading association' }, { authenticated: false });\n    }\n    if (!association) {\n      return callback({ message: 'Invalid association handle' }, { authenticated: false });\n    }\n    if (association.provider.version.indexOf('2.0') !== -1 && association.provider.endpoint !== params['openid.op_endpoint']) {\n      return callback({ message: 'Association handle does not match provided endpoint' }, { authenticated: false });\n    }\n\n    var message = '';\n    var signedParams = params['openid.signed'].split(',');\n    for (var i = 0; i < signedParams.length; i++) {\n      var param = signedParams[i];\n      var value = params['openid.' + param];\n      if (!_isDef(value)) {\n        return callback({ message: 'At least one parameter referred in signature is not present in response' }, { authenticated: false });\n      }\n      message += param + ':' + value + '\\n';\n    }\n\n    var hmac = crypto.createHmac(association.type, _buffer(association.secret, 'base64'));\n    hmac.update(message, 'utf8');\n    var ourSignature = hmac.digest('base64');\n\n    if (ourSignature == params['openid.sig']) {\n      callback(null, { authenticated: true, claimedIdentifier: association.provider.version.indexOf('2.0') !== -1 ? params['openid.claimed_id'] : association.provider.claimedIdentifier });\n    }\n    else {\n      callback({ message: 'Invalid signature' }, { authenticated: false });\n    }\n  });\n}\n\nvar _checkSignatureUsingProvider = function (params, provider, callback) {\n  var requestParams =\n  {\n    'openid.mode': 'check_authentication'\n  };\n  for (var key in params) {\n    if (hasOwnProperty(params, key) && key != 'openid.mode') {\n      requestParams[key] = params[key];\n    }\n  }\n\n  _post(_isDef(params['openid.ns']) ? (params['openid.op_endpoint'] || provider.endpoint) : provider.endpoint, requestParams, function (data, headers, statusCode) {\n    if (statusCode != 200 || data == null) {\n      return callback({ message: 'Invalid assertion response from provider' }, { authenticated: false });\n    }\n    else {\n      data = _decodePostData(data);\n      if (data['is_valid'] == 'true') {\n        return callback(null, { authenticated: true, claimedIdentifier: provider.version.indexOf('2.0') !== -1 ? params['openid.claimed_id'] : params['openid.identity'] });\n      }\n      else {\n        return callback({ message: 'Invalid signature' }, { authenticated: false });\n      }\n    }\n  });\n\n}\n\n\nvar _getCanonicalClaimedIdentifier = function (claimedIdentifier) {\n  if (!claimedIdentifier) {\n    return claimedIdentifier;\n  }\n\n  var index = claimedIdentifier.indexOf('#');\n  if (index !== -1) {\n    return claimedIdentifier.substring(0, index);\n  }\n\n  return claimedIdentifier;\n};\n\n/* ==================================================================\n * Extensions\n * ================================================================== \n */\n\nvar _getExtensionAlias = function (params, ns) {\n  for (var k in params)\n    if (params[k] == ns)\n      return k.replace(\"openid.ns.\", \"\");\n}\n\n/* \n * Simple Registration Extension\n * http://openid.net/specs/openid-simple-registration-extension-1_1-01.html\n */\n\nvar sreg_keys = ['nickname', 'email', 'fullname', 'dob', 'gender', 'postcode', 'country', 'language', 'timezone'];\n\nopenid.SimpleRegistration = function SimpleRegistration(options) {\n  this.requestParams = { 'openid.ns.sreg': 'http://openid.net/extensions/sreg/1.1' };\n  if (options.policy_url)\n    this.requestParams['openid.sreg.policy_url'] = options.policy_url;\n  var required = [];\n  var optional = [];\n  for (var i = 0; i < sreg_keys.length; i++) {\n    var key = sreg_keys[i];\n    if (options[key]) {\n      if (options[key] == 'required') {\n        required.push(key);\n      }\n      else {\n        optional.push(key);\n      }\n    }\n    if (required.length) {\n      this.requestParams['openid.sreg.required'] = required.join(',');\n    }\n    if (optional.length) {\n      this.requestParams['openid.sreg.optional'] = optional.join(',');\n    }\n  }\n};\n\nopenid.SimpleRegistration.prototype.fillResult = function (params, result) {\n  var extension = _getExtensionAlias(params, 'http://openid.net/extensions/sreg/1.1') || 'sreg';\n  for (var i = 0; i < sreg_keys.length; i++) {\n    var key = sreg_keys[i];\n    if (params['openid.' + extension + '.' + key]) {\n      result[key] = params['openid.' + extension + '.' + key];\n    }\n  }\n};\n\n/* \n * User Interface Extension\n * http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html \n */\nopenid.UserInterface = function UserInterface(options) {\n  if (typeof (options) != 'object') {\n    options = { mode: options || 'popup' };\n  }\n\n  this.requestParams = { 'openid.ns.ui': 'http://specs.openid.net/extensions/ui/1.0' };\n  for (var k in options) {\n    this.requestParams['openid.ui.' + k] = options[k];\n  }\n};\n\nopenid.UserInterface.prototype.fillResult = function (params, result) {\n  // TODO: Fill results\n}\n\n/* \n * Attribute Exchange Extension\n * http://openid.net/specs/openid-attribute-exchange-1_0.html \n * Also see:\n *  - http://www.axschema.org/types/ \n *  - http://code.google.com/intl/en-US/apis/accounts/docs/OpenID.html#Parameters\n */\n\nvar attributeMapping =\n{\n  'http://axschema.org/contact/country/home': 'country'\n  , 'http://axschema.org/contact/email': 'email'\n  , 'http://axschema.org/namePerson/first': 'firstname'\n  , 'http://axschema.org/pref/language': 'language'\n  , 'http://axschema.org/namePerson/last': 'lastname'\n  // The following are not in the Google document:\n  , 'http://axschema.org/namePerson/friendly': 'nickname'\n  , 'http://axschema.org/namePerson': 'fullname'\n};\n\nopenid.AttributeExchange = function AttributeExchange(options) {\n  this.requestParams = {\n    'openid.ns.ax': 'http://openid.net/srv/ax/1.0',\n    'openid.ax.mode': 'fetch_request'\n  };\n  var required = [];\n  var optional = [];\n  for (var ns in options) {\n    if (!hasOwnProperty(options, ns)) { continue; }\n    if (options[ns] == 'required') {\n      required.push(ns);\n    }\n    else {\n      optional.push(ns);\n    }\n  }\n  var self = this;\n  required = required.map(function (ns, i) {\n    var attr = attributeMapping[ns] || 'req' + i;\n    self.requestParams['openid.ax.type.' + attr] = ns;\n    return attr;\n  });\n  optional = optional.map(function (ns, i) {\n    var attr = attributeMapping[ns] || 'opt' + i;\n    self.requestParams['openid.ax.type.' + attr] = ns;\n    return attr;\n  });\n  if (required.length) {\n    this.requestParams['openid.ax.required'] = required.join(',');\n  }\n  if (optional.length) {\n    this.requestParams['openid.ax.if_available'] = optional.join(',');\n  }\n}\n\nopenid.AttributeExchange.prototype.fillResult = function (params, result) {\n  var extension = _getExtensionAlias(params, 'http://openid.net/srv/ax/1.0') || 'ax';\n  var regex = new RegExp('^openid\\\\.' + extension + '\\\\.(value|type|count)\\\\.(\\\\w+)(\\\\.(\\\\d+)){0,1}$');\n  var aliases = {};\n  var counters = {};\n  var values = {};\n  for (var k in params) {\n    if (!hasOwnProperty(params, k)) { continue; }\n    var matches = k.match(regex);\n    if (!matches) {\n      continue;\n    }\n    if (matches[1] == 'type') {\n      aliases[params[k]] = matches[2];\n    }\n    else if (matches[1] == 'count') {\n      //counter sanitization\n      var count = parseInt(params[k], 10);\n\n      // values number limitation (potential attack by overflow ?)\n      counters[matches[2]] = (count < AX_MAX_VALUES_COUNT) ? count : AX_MAX_VALUES_COUNT;\n    }\n    else {\n      if (matches[3]) {\n        //matches multi-value, aka \"count\" aliases\n\n        //counter sanitization\n        var count = parseInt(matches[4], 10);\n\n        // \"in bounds\" verification\n        if (count > 0 && count <= (counters[matches[2]] || AX_MAX_VALUES_COUNT)) {\n          if (!values[matches[2]]) {\n            values[matches[2]] = [];\n          }\n          values[matches[2]][count - 1] = params[k];\n        }\n      }\n      else {\n        //matches single-value aliases\n        values[matches[2]] = params[k];\n      }\n    }\n  }\n  for (var ns in aliases) {\n    if (aliases[ns] in values) {\n      result[aliases[ns]] = values[aliases[ns]];\n      result[ns] = values[aliases[ns]];\n    }\n  }\n}\n\nopenid.OAuthHybrid = function (options) {\n  this.requestParams = {\n    'openid.ns.oauth': 'http://specs.openid.net/extensions/oauth/1.0',\n    'openid.oauth.consumer': options['consumerKey'],\n    'openid.oauth.scope': options['scope']\n  };\n}\n\nopenid.OAuthHybrid.prototype.fillResult = function (params, result) {\n  var extension = _getExtensionAlias(params, 'http://specs.openid.net/extensions/oauth/1.0') || 'oauth'\n    , token_attr = 'openid.' + extension + '.request_token';\n\n\n  if (params[token_attr] !== undefined) {\n    result['request_token'] = params[token_attr];\n  }\n};\n\n/* \n * Provider Authentication Policy Extension (PAPE)\n * http://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html\n * \n * Note that this extension does not validate that the provider is obeying the\n * authentication request, it only allows the request to be made.\n *\n * TODO: verify requested 'max_auth_age' against response 'auth_time'\n * TODO: verify requested 'auth_level.ns.<cust>' (etc) against response 'auth_level.ns.<cust>'\n * TODO: verify requested 'preferred_auth_policies' against response 'auth_policies'\n *\n */\n\n/* Just the keys that aren't open to customisation */\nvar pape_request_keys = ['max_auth_age', 'preferred_auth_policies', 'preferred_auth_level_types'];\nvar pape_response_keys = ['auth_policies', 'auth_time']\n\n/* Some short-hand mappings for auth_policies */\nvar papePolicyNameMap =\n{\n  'phishing-resistant': 'http://schemas.openid.net/pape/policies/2007/06/phishing-resistant',\n  'multi-factor': 'http://schemas.openid.net/pape/policies/2007/06/multi-factor',\n  'multi-factor-physical': 'http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical',\n  'none': 'http://schemas.openid.net/pape/policies/2007/06/none'\n}\n\nopenid.PAPE = function PAPE(options) {\n  this.requestParams = { 'openid.ns.pape': 'http://specs.openid.net/extensions/pape/1.0' };\n  for (var k in options) {\n    if (k === 'preferred_auth_policies') {\n      this.requestParams['openid.pape.' + k] = _getLongPolicyName(options[k]);\n    } else {\n      this.requestParams['openid.pape.' + k] = options[k];\n    }\n  }\n  var util = require('util');\n};\n\n/* you can express multiple pape 'preferred_auth_policies', so replace each\n * with the full policy URI as per papePolicyNameMapping. \n */\nvar _getLongPolicyName = function (policyNames) {\n  var policies = policyNames.split(' ');\n  for (var i = 0; i < policies.length; i++) {\n    if (policies[i] in papePolicyNameMap) {\n      policies[i] = papePolicyNameMap[policies[i]];\n    }\n  }\n  return policies.join(' ');\n}\n\nvar _getShortPolicyName = function (policyNames) {\n  var policies = policyNames.split(' ');\n  for (var i = 0; i < policies.length; i++) {\n    for (shortName in papePolicyNameMap) {\n      if (papePolicyNameMap[shortName] === policies[i]) {\n        policies[i] = shortName;\n      }\n    }\n  }\n  return policies.join(' ');\n}\n\nopenid.PAPE.prototype.fillResult = function (params, result) {\n  var extension = _getExtensionAlias(params, 'http://specs.openid.net/extensions/pape/1.0') || 'pape';\n  var paramString = 'openid.' + extension + '.';\n  var thisParam;\n  for (var p in params) {\n    if (hasOwnProperty(params, p)) {\n      if (p.substr(0, paramString.length) === paramString) {\n        thisParam = p.substr(paramString.length);\n        if (thisParam === 'auth_policies') {\n          result[thisParam] = _getShortPolicyName(params[p]);\n        } else {\n          result[thisParam] = params[p];\n        }\n      }\n    }\n  }\n}\n"]}